Thats valid, as I didnt peep that. That still might not matter, especially since its criminal.
If the company found out, it wouldn't matter whether they're direct reports or not. Many companies have guidelines or regulations that make people with supervisory responsibilities something akin to mandated reporter; at colleges, they're referred to as Responsible Employees.
I doubt Rockauto.com or wherever your girl works probably isn't as stringent as that, but she should absolutely prtoctect herself. If they're in a consensual relationship let them explain that then. Whatever consequences there would be from management/corporate that you knew about this and didnt say anything seem worse than reporting to me.